CVE-2020-25698
published 2020-11-19CVE-2020-25698: Users' enrollment capabilities were not being sufficiently checked in Moodle when they are restored into an existing course. This could lead to them…
PriorityP342high7.5CVSS 3.1
AVNACLPRNUINSUCNIHAN
EPSS
1.92%
79.8th percentile
Users' enrollment capabilities were not being sufficiently checked in Moodle when they are restored into an existing course. This could lead to them unenrolling users without having permission to do so. Versions affected: 3.5 to 3.5.14, 3.7 to 3.7.8, 3.8 to 3.8.5, 3.9 to 3.9.2 and earlier unsupported versions. Fixed in 3.9.3, 3.8.6, 3.7.9, 3.5.15, and 3.10.
Affected
15 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| moodle | moodle | — | — |
| moodle | moodle | — | — |
| moodle | moodle | — | — |
| moodle | moodle | — | — |
| moodle | moodle | — | — |
| moodle | moodle | >= 3.5 < 3.5.15 | 3.5.15 |
| moodle | moodle | 3.5.0 – 3.5.14 | — |
| moodle | moodle | >= 3.7.0 < 3.7.9 | 3.7.9 |
| moodle | moodle | 3.7.0 – 3.7.8 | — |
| moodle | moodle | >= 3.8.0 < 3.8.6 | 3.8.6 |
| moodle | moodle | 3.8.0 – 3.8.5 | — |
| moodle | moodle | >= 3.9.0 < 3.9.3 | 3.9.3 |
| moodle | moodle | 3.9.0 – 3.9.2 | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:P/A:N
osv7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Improper Access Control in moodle
osv·2021-03-29
CVE-2020-25698 [HIGH] Improper Access Control in moodle
Improper Access Control in moodle
Users' enrollment capabilities were not being sufficiently checked in Moodle when they are restored into an existing course. This could lead to them unenrolling users without having permission to do so. Versions affected: 3.5 to 3.5.14, 3.7 to 3.7.8, 3.8 to 3.8.5, 3.9 to 3.9.2 and earlier unsupported versions. Fixed in 3.9.3, 3.8.6, 3.7.9, 3.5.15, and 3.10.
GHSA
Improper Access Control in moodle
ghsa·2021-03-29
CVE-2020-25698 [HIGH] CWE-284 Improper Access Control in moodle
Improper Access Control in moodle
Users' enrollment capabilities were not being sufficiently checked in Moodle when they are restored into an existing course. This could lead to them unenrolling users without having permission to do so. Versions affected: 3.5 to 3.5.14, 3.7 to 3.7.8, 3.8 to 3.8.5, 3.9 to 3.9.2 and earlier unsupported versions. Fixed in 3.9.3, 3.8.6, 3.7.9, 3.5.15, and 3.10.
OSV
CVE-2020-25698: Users' enrollment capabilities were not being sufficiently checked in Moodle when they are restored into an existing course
osv·2020-11-19·CVSS 7.5
CVE-2020-25698 [HIGH] CVE-2020-25698: Users' enrollment capabilities were not being sufficiently checked in Moodle when they are restored into an existing course
Users' enrollment capabilities were not being sufficiently checked in Moodle when they are restored into an existing course. This could lead to them unenrolling users without having permission to do so. Versions affected: 3.5 to 3.5.14, 3.7 to 3.7.8, 3.8 to 3.8.5, 3.9 to 3.9.2 and earlier unsupported versions. Fixed in 3.9.3, 3.8.6, 3.7.9, 3.5.15, and 3.10.
No detection rules found.
No public exploits indexed.
https://bugzilla.redhat.com/show_bug.cgi?id=1895419https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4NNFCHPPHRJNJROIX6SYMHOC6HMKP3GU/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B55KXBVAT45MDASJ3EK6VIGQOYGJ4NH6/https://moodle.org/mod/forum/discuss.php?d=413935https://bugzilla.redhat.com/show_bug.cgi?id=1895419https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4NNFCHPPHRJNJROIX6SYMHOC6HMKP3GU/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B55KXBVAT45MDASJ3EK6VIGQOYGJ4NH6/https://moodle.org/mod/forum/discuss.php?d=413935
2020-11-19
Published